Here are my thoughts:
Management very rarely understands technology and its place in business. Most times, management has misconceptions about what technology is and how it affects business. Yes, it's true that mismanagement of technology often leads to wasteful spending, but proper management increases productivity dramatically. Waste generally happens when you have people who think they understand technology do it wrong or for the wrong reasons.
- we have coped for years without an issue
Coping doesn't essentially mean doing things the right way or the most effective way. Coping often leads to complacency, which sets a shaky foundation for ethics and compliance, but it means you don't have to invest any money in anything new.
This is a double-edged sword. I'm fond of the phrase, "trust, but verify". Yes, all people **should** be "innocent until proven guilty", but experience in information security will tell you that 70% of intrusions occur from an inside/trusted source. Yes, retail waste can be controlled at the transaction and properly developed practices and policies limit these risks, but no industry is ever safe from insider threats. However pretending like there aren't any problems is an easy way to avoid spending money.
- if I left then no-one would be able to understand how it works
This phrase only extrapolates on how misunderstood technology is. A company that doesn't shape it's practices, policies, and technology on standards is more likely to experience a devastating disaster if/when their technology staff parts ways. The amount of time it takes to train an employee on systems particular to a business is on average 3-6 months, depending on complexity, intricacy, diversity and volume. Following a standard means less time wasted attempting to find the "right" candidate. Not following a standard means finding people with a broad enough skillset to survive 3-6 months, while drowning in a lake of fire. But, convincing one's self of this is easier than spending money on employing expensive IT staff.
- Setup costs for new hardware and licensing are high compared to the $0 now.
This isn't completely accurate. In almost all industries (other than technology), the IT department is a cost center (meaning, the department does not derive any profits). Buying/replacing computers, routers, switches, cables, plugs, etc... In regards to setting up a centralized management infrastructure (a "domain" as you put it), yes, it would cost money to buy servers and time to engineer a solution to put the right things in place to manage things. Depending on the size of the environment, it can take 4 hours or 400 hours to do properly, and it will continue to cost money to maintain throughout it's life-span. It can get pretty expensive, pretty quickly.
At this point, you might be thinking, "Wait a minute; most of what you're saying is in favor of my boss's stance on not doing what I'm suggesting." Well, you're 1/2 right.
Although, technically speaking; so long as a solution is standardized and the practices/policies are not overtly complex/time-consuming, replacing staff is as simple as finding candidates that have experience with those standards. This really isn't an arguing point.
The other 1/2 is that you need to understand the cost/benefit of putting the technology you want in place as well. It could and it could not be worth the expense. You won't know unless you can spend time putting together your own cost/benefit analysis. To do this, you need to consider the costs (note: these are just the start of the questions you should ask yourself before you bring your approach to your boss again):
- how much is a server?
- how many servers do I need?
- how much is licensing?
- how many licenses do I need?
- will my network be able to handle the bandwidth change due to increased traffic from a management network?
- do I need to change my infrastructure?
- do I need to change any of my end-point systems to meet a bare minimum requirement for my domain?
- do I know how to set up my own domain or do I need to bring in a 3rd party to drop a turn-key solution for me? and if so, how much will they cost?
- how many issues exist in the environment and how much time do I spend working on them that could be mitigated, relieved or reduced with the solution I'm proposing?
- how much money is being spent working on issues that could be mitigated, relieved or reduced with the solution I'm proposing (including cost of my time, cost of employee downtime, and cost of actual or potential business loss)?
Again, keep in mind that the questions I proposed above are not all-inclusive. There are more technical questions that could be asked, which lead to other questions and so forth, and so forth. Once you have all those numbers, determine the following:
- Will implementing the technology truly mitigate, relieve or reduce the amount of time/money/effort spent on recurring problematic issues?
- Will implementing the technology adversely offset the cost of coping/complacency?
Once you're able to develop a proper cost/benefit analysis, you'll be better able to approach your employer with a proper solution, as opposed to an unfounded suggestion.
Based on my experience, the cost of implementing a centralized management infrastructure and the cost of continued support of said infrastructure is equivalent to the cost of hiring another body for the IT department (depending on the size of the environment); at least, with implementing an internal solution. Cloud and SaaS solutions available today may offset the cost of physical infrastructure and save some money, but it really depends on the department's or company's business model and security constraints.
Note: if the cost of implementing a solution is more expensive than hiring a full-time person to deal with the issues the solution is supposed to resolve, it's generally more cost effective to hire the body (depending on the complexity of the issue needing to be mitigated, relieved or reduced).
TL;DR: spend some time relating to your boss though dollar amounts as opposed to a fancy IT alphabet. It may or may not help your argument, but whatever happens, you end up learning more about how to manage your infrastructure more efficiently.
Lastly, if your conclusion is that the company desperately needs the solution, can afford it, and your boss still doesn't want to do what you say for illogical reasons you can't negotiate reasonable middle-ground, it's time to pack your things and find a new employer. The kind of employers who are OK being mediocre and don't make logical decisions when presented with evidence are not the type of employers you want to stick with; they tend to be make bad decisions and take everyone around them down.
Calculating cost of time
Scenario: One aspect of meeting PCI DSS compliance requires your end-point/POS computers to be up-to-date with patches (or have a patch management process in place).
Let's say you make $15/hr USD or $31,200/yr USD, and to make sure patches don't break your systems, you have to manually patch all your systems every time a new patch comes out. For simplicity sake, let's also say a centralized management infrastructure (Note: this is just a simplified view; it really depends on how your offices are interconnected, whether you need redundancy, and whether or not it makes sense to have a server in every office or just one) will cost you $11,000 for a server, $2,500 for the server license and $2,500 for CALs and 80 hours to set up a domain and join all the computers to the domain; 80 hrs x $15/hr = $1,200 (more if you're outsourcing it to a local vendor; highball is $120/hr; so 80 hrs x $120/hr = $9,600). Your total centralized management infrastructure could be put in place for roughly $17,200 to $25,600.
Patch Tuesday occurs every 2nd and 4th Tuesday of every month. If there is even 1 patch released every Patch Tuesday, that requires anywhere between 15min-30min to install and reboot, you're spending at least 1 hour every month patching 1 computer; or 12 hours per year.
Already, you're spending: 12 hrs x $15 = $180 per year on patch management for 1 computer. Now, multiple that by the 50 computers you have (because remember, you can't let the systems automatically patch, because you don't know if the patches will break any apps you currently have installed). This mean you're spending closer to $180/yr x 50 computers = $9,000 on patch management. That's 28.85% of your wage and...
- 15min x 50 computers = 750min or 12.5hrs or 1.56 days minimum
- 30min x 50 computers = 1,500min or 25hrs or 3.13 days maximum
spent on a menial task that can be managed by a centralized management infrastructure; testing a patches is simplified now, only based on the number "images" you have, where an "image" is a base copy of the OS and Apps that a group of systems use. At this point, you're only spending 15-30min per image, as opposed to 1.56-3.13 days. This doesn't include travel time if that's required nor does it include wasting/waiting for people to get off the computer so you can do your job.
Wait, $9,000 doesn't seem like it'll justify my request. Maybe, but have you considered centralizing your end-point security solution (anti-virus, anti-malware, etc...)? Oh boy! That's another $9,000 if you consider end-point updates happen every week! Plus, being able to identify which systems are infected with viruses and pin-pointing the computer AND person is a HUGE victory; now you know which groups of people you need to educate on information security awareness.
Wait! You're saying that's still not enough? Oh? How about now being able to implement Group Policy to prevent people from doing things they shouldn't? That's gotta be worth a pretty penny in risk prevention. Oh man, you're saying that's still not enough? What if I told you you can now remotely image/format and reinstall a system without ever having to leave the office!? Oh boy! Wouldn't that be worth something? That's 2-4 hours per system that you're saving; potentially 100-200 hours per refresh period.
So, what am I implying with my generic info from above? Well, potentially, you could save $18,000 minimum by implementing a centralized management system (Windows AD). That's more than 1/2 the salary of an IT guy making $15/hr. $18,000 is more than the cost of the solution (well, my basic solution; you'll need to figure out your own actual numbers), which means the solution will pay for itself over time; technically, within 12 months of implementation.
These numbers do not take into account any projects that may require having a centralized management infrastructure in place to begin with. For every project moving forward that you needed an Active Directory for, it's now a 50 times how-ever-much-time-you-spent-implementing-it-on-one-system times your hourly-wage in savings.
This also does not take into account the capability of now implementing proper user authentication, password aging, password complexity requirements, and a slew of other risk management practices and policies that could potentially save the company lots of money in the event of a breach/intrusion or compromise.
Oh, by the way, you can always throw compliance requirements at people, too. Just for good measure. There is no way your company is PCI compliant if people are sharing passwords.
Get the idea now? Now, get to it.